DE102018220605B4 - Motor vehicle network and method for operating a motor vehicle network - Google Patents

Abstract

Motor vehicle network (100) with a primary network (102), comprising at least the following components: a first sensor device (108, 302), a first processing device (110, 304), a first actuator device (112, 306), and a first communication device (114, 314), which is designed to couple the first sensor device (108, 302), the first processing device (110, 304) and the first actuator device (112, 306) to one another for data transmission, characterized in that the motor vehicle network (100) further comprises: - a secondary network (104), which has as components at least: a second sensor device (116, 308), a second processing device (118, 310), a second actuator device (120, 312), and a second communication device (122, 316), which is designed to couple the second sensor device (116, 308), the second Processing device (118, 310) and the second actuator device (120, 312) for data transmission, wherein the components of the secondary network (104) are designed to be redundant with respect to their function in relation to the components of the primary network (102),- a first energy supply device (124) which is designed to supply only the primary network (102) with energy, and- a second energy supply device (126) which is separate from the first energy supply device (124) and which is designed to supply only the secondary network (104) with energy, wherein the second energy supply device (126) is designed to be redundant with respect to the first energy supply device (124), and- at least one monitoring device (106) which is designed to monitor at least one of the components of the primary network (102), wherein in the event that the monitoring device (106) detects a malfunction of the at least one monitored component of the primary network (102), the at least one component of the secondary network which is designed to be redundant with respect to this (104) is designed to take over the function of the at least one malfunctioning component of the primary network (102), wherein the monitoring device (106) is further designed to also monitor the first energy supply device (124) and, in the event that the monitoring device (106) detects a malfunction of the first energy supply device (124), to control all components of the secondary network (104) to take over the function of all components of the primary network (102).

Description

The invention relates to a motor vehicle network and a method for operating the motor vehicle network according to the preamble of the independent patent claims.

A motor vehicle network is understood to be a network architecture for individual components, in particular electronic components, of a motor vehicle. The components can include, for example, sensor devices, processing devices and actuator devices that are linked to one another via a communication device. In particular in the case of self-driving motor vehicles, i.e. motor vehicles with a highly automated driving function (HAD function), in particular with an autonomy level greater than or equal to three, according to the SAE J3016 standard, hereinafter also referred to as autonomous motor vehicles, in which a driver of the motor vehicle generally no longer intervenes in the driving function or no longer needs to drive the motor vehicle himself, it is important that the motor vehicle network is designed to be as fail-safe as possible. If one of the components of the motor vehicle network fails while driving, the HAF function can no longer be guaranteed. In this case, the motor vehicle usually carries out emergency braking or the driver is asked to take over control of the motor vehicle. However, especially at speeds above 60 km/h, emergency braking can surprise other road users and thus increase the risk of an accident. At these speeds, the driver is often no longer able to take control of the vehicle quickly enough to avoid an obstacle, for example.

One possibility for designing a fail-safe system is, for example, in the GB 2 419 430 A disclosed.

Furthermore, the EP 0 913 751 A1 An autonomous vehicle and a method for controlling an autonomous vehicle are known.

In addition, the EN 10 2006 062 300 A1 A circuit for controlling an acceleration, braking and steering system of a vehicle is known, which has a higher level of security against failures of the acceleration, braking and steering system.

In addition, the EN 10 2017 122 519 A1 a vehicle system for fail-safe autonomous driving is known.

Finally, the EN 10 2015 104 104 A1 Redundant electricity for autonomous vehicles is still known.

The above-mentioned state of the art has the disadvantage that a failure of one of the components of the motor vehicle network can, despite fail-safe protection, still cause a malfunction in the entire motor vehicle network.

The invention is based on the task of further improving the driving safety of autonomous motor vehicles in road traffic.

The object is achieved by the subject matter of the independent patent claims. Advantageous developments of the invention are disclosed by the dependent patent claims, the following description and the figures.

The invention provides a motor vehicle network with a primary network. The primary network comprises the following components: a first sensor device, a first processing device, a first actuator device and a first communication device which is designed to couple the first sensor device, the first processing device and the first actuator device to one another for data transmission. The motor vehicle network also comprises a secondary network which comprises the following components: a second sensor device, a second processing device, a second actuator device and a second communication device which is designed to couple the second sensor device, the second processing device and the second actuator device to one another for data transmission. The components of the secondary network are designed to be redundant to the components of the primary network in terms of their function. Finally, the motor vehicle network also comprises at least one monitoring device which is designed to monitor at least one of the components of the primary network, wherein in the event that the monitoring device detects a malfunction of the at least one monitored component of the primary network, the at least one redundant component of the secondary network is designed to take over the function of the at least one malfunctioning component of the primary network.

In other words, the motor vehicle network comprises two separate networks, namely the primary network and the secondary network. Both networks or the components of both networks are designed to be redundant to each other. This means that both networks or the components of both networks can perform the same function independently of each other. The components of the secondary network are preferably designed to be functionally identical to the components of the primary network. Thus, for each component in the primary network, a redundant or functionally identical component is provided in the secondary network, and vice versa. This means that the first sensor device is designed to be redundant to the second sensor device, the first processing device is designed to be redundant to the second processing device, the first actuator device is designed to be redundant to the second actuator device, and the first communication device is designed to be redundant to the second communication device. This also applies vice versa, of course.

In addition, a first energy supply device is also provided, which is designed to supply the primary network with energy, and a second energy supply device is provided, which is designed to supply the secondary network with energy, wherein the second energy supply device is designed to be redundant to the first energy supply device.

This means that both the primary network and the secondary network each have a separate energy supply device. The at least one monitoring device is designed to also monitor the first energy supply device and, in the event that the monitoring device detects a malfunction of the first energy supply device, to control all components of the secondary network to take over the function of all components of the primary network.

This has the advantage that even in the event of a power failure of the primary network, a fail-safe mechanism is provided by the secondary network and the power supply of the secondary network.

The invention is based on the finding that a redundant design of only individual components of a motor vehicle network, as provided for in the prior art, is not sufficient to ensure the reliability of the HAF function of an autonomous motor vehicle. A malfunction in the form of a single point of failure (SPoF) is not covered by the prior art. A SpoF describes a malfunction of one of the components of the motor vehicle network, which usually triggers a chain reaction so that the entire motor vehicle network fails to a large extent. Malfunctions can generally be divided into hardware and software errors. A hardware error can occur, for example, due to a short circuit, water ingress, a design error or a defective connection of one of the components of the motor vehicle network. A software error can in particular be an error in the programming of one of the components of the motor vehicle network, so that the component, for example, falsifies data as a babbling idiot and thus transmits incorrect data to the other components.

The invention provides the advantage that the HAF function can continue to be used to drive the motor vehicle despite the failure of one of the components of the primary network or even the entire primary network. This means that no matter which or how many of the components of the primary network fail, a replacement component is provided in the secondary network for each of the components of the primary network, so that the reliability of the HAF function is guaranteed.

Another advantage is that, particularly at higher speeds, for example over 60 km/h, if a malfunction of one of the components of the primary network is detected, no emergency braking of the autonomous vehicle needs to be initiated, and the driver of the autonomous vehicle does not need to be asked to take over steering, depending on the level of autonomy of the HAF function. In particular, in heavy traffic, such as in a city or on a motorway, emergency braking could surprise other road users, increasing the risk of an accident. In heavy traffic, the driver's reaction time is often not sufficient to take over control of the autonomous vehicle in the event of a malfunction, especially if, for example, a vehicle ahead suddenly brakes.

Furthermore, at speeds above 60 km/h, if a malfunction of one of the sensor devices is detected, the problem arises that the autonomous motor vehicle will move out of the area of the environment detected at the time the malfunction occurred due to the speed and range of the sensor device according to the state of the art. In addition, at speeds above 60 km/h, the time required for the autonomous motor vehicle to come to a standstill when a malfunction of a sensor device is detected is so long that the dynamic changes in the environment must be able to influence the reaction of the HAF function until the HAF function ends.

The advantage of providing a replacement network, i.e. the secondary network, is that emergency braking is initially unnecessary. In addition, the driver can be informed early on that the secondary network has taken over control of the autonomous vehicle. This gives the driver sufficient time to decide whether or not he wants to take over control of the vehicle himself. This reduces the overall risk of an accident due to the failure of a component of the vehicle network and consequently improves the driving safety of an autonomous vehicle on the road.

Preferably, the respective sensor device can record environmental data from an environment of the autonomous motor vehicle and/or from a motor vehicle interior. The sensor device can comprise a plurality of sensor elements. The sensor elements can be designed, for example, as at least one camera and/or at least one radar sensor and/or at least one laser scanner for recording the environmental data.

Furthermore, the respective processing device can be designed to analyze and process the recorded environmental data in order to generate control commands for the respective actuator device. In addition, the respective processing device can also be designed to control the sensor device to record the environmental data. The respective processing device can preferably have at least one control device with a computing unit, such as a microcontroller. The respective processing device can comprise several processing elements, such as an energy management control device and/or a chassis control device and/or a sensor device control device.

Furthermore, the respective actuator device can be designed to execute the control commands of the respective processing device. The respective actuator device can comprise at least one actuator element, such as a braking device and/or a steering system and/or body electronics, such as an alternator. However, each of the components of the primary network does not need to be installed in duplicate in the motor vehicle by means of a replacement component in the secondary network. It is sufficient to only design a replacement component for those components of the primary network that are absolutely necessary for the safest possible journey with the autonomous motor vehicle. For example, an alternator can only be designed in the secondary network if the alternator is designed to operate the headlights of the motor vehicle. An alternator that is designed, for example, for interior lighting of the motor vehicle does not necessarily have to be designed redundantly in the secondary network.

The respective communication device can preferably be designed as a data bus, such as a CAN bus and/or a Flexray bus and/or an Ethernet. The first communication device can in particular be designed in such a way that data transmission from the first sensor device to the first processing device and vice versa, as well as between the first processing device and the first actuator device and vice versa, is enabled. Furthermore, the first communication device can also be designed to couple the individual sensor elements of the first sensor device, for example the camera, the radar and the laser scanner, to one another for data transmission. This can also apply analogously to the individual processing elements of the first processing device and the individual actuator elements of the first actuator device. Accordingly, the second communication device can be designed to enable data transmission from the second sensor device to the second processing device and vice versa, as well as data transmission from the second processing device to the second actuator device and vice versa. Accordingly, the second communication device can also be designed to couple the individual sensor elements of the second sensor device to one another, to couple the individual processing elements of the second processing device to one another, and to couple the individual actuator elements of the second actuator device to one another.

The invention also includes embodiments which provide additional advantages.

One embodiment provides that the at least one monitoring device is designed, upon detecting a malfunction of the at least one monitored component of the primary network, to control the at least one redundant component of the secondary network to take over the function of the malfunctioning component of the primary network.

If the at least one monitoring device detects a malfunction, for example the failure of one of the components of the primary network, the at least one monitoring device can control at least one component of the secondary network so that the at least one component of the secondary network can take over the function of the at least one component of the primary network. In doing so, the at least one a monitoring device monitors the component of the secondary network that is redundant to the component of the primary network that is experiencing a malfunction.

If, for example, the first sensor device fails, the at least one monitoring device can control the second sensor device so that the second sensor device can record the surroundings data of the autonomous motor vehicle instead of the first sensor device. The first sensor device and the second sensor device can be functionally identical, but do not necessarily have to be of the same type. In this case, functionally identical can mean that the two sensor devices are identical in terms of their function. This means that both sensor devices are designed as a camera, for example, and both sensor devices are designed to record images or image sequences of the surroundings of the motor vehicle. However, the first image capture device can be manufactured by a first manufacturer, for example. In contrast, the second image capture device can be manufactured by a second manufacturer, for example. The first manufacturer can preferably use different components for the first image capture device than the second manufacturer uses for the second image capture device.

A further embodiment provides that the motor vehicle network comprises a third communication device which is designed to couple at least one of the components of the primary network directly to at least one of the components of the secondary network for data transmission.

The third communication device can represent an interconnect, so to speak, i.e. a so-called intermediate connection device between one of the components of the primary network and one of the components of the secondary network. The third communication device can be designed in such a way that data transmission is possible between the redundant components of the primary network and the secondary network. For example, an actual function of one of the components of the primary network can be disrupted, but data processing and data transmission in the component itself can still be functional. In this case, data transmission between the two redundant components can take place via the third communication device. The component of the secondary network can take over the actual function of the non-functional component of the primary network and then transmit the recorded data to the redundant component of the primary network. As a result, the component of the secondary network is directly coupled to the redundant component of the primary network. Consequently, the component of the secondary network is also indirectly coupled to the other components of the primary network, via the redundant component of the primary network. For example, the first processing device can be directly coupled, i.e. in particular connected, to the second processing device via the third communication device. At the same time, the second processing device can also be indirectly coupled to the first sensor device or the first actuator device via the first processing device.

Additionally or alternatively, the third communication device can also be designed to enable data transmission between one of the components of the primary network and a component of the secondary network that is not redundant. This means that the inoperable component is then essentially skipped in the data transmission. The data transmission can therefore take place directly between at least one functional component of the primary network and a component of the secondary network that is not redundant. This means that, for example, the first sensor device can be coupled, in particular connected, to the second processing device via the third communication device.

The third communication device can therefore represent a network of the individual components of the primary network with the individual components of the secondary network. The third communication device can comprise at least one interconnect for coupling at least one component of the primary network with at least one component of the secondary network. However, the third communication device particularly preferably has a plurality of interconnects, so that each of the components of the primary network is coupled with at least one component of the secondary network, and vice versa.

This has the advantage that not only is data transfer between the individual components of the primary network possible, but also data transfer between the components of the primary network and the components of the secondary network.

Preferably, the third communication device can also be implemented as a data bus, for example as a CAN bus and/or as Flexray and/or as Ethernet. Furthermore, it can be provided that the third communication tion device, i.e. in particular each of the interconnects which couples at least one component of the primary network to at least one component of the secondary network, is designed to be galvanically isolated or separable, for example via an optocoupler or a fuse. In this way, the secondary network can be decoupled from the primary network in the event of a malfunction of one of the components of the primary network.

A further embodiment provides that the at least one monitoring device is designed to control the third communication device upon detection of the malfunction of the at least one monitored component of the primary network in order to enable direct data transmission between at least one of the functional components of the primary network and at least one of the functional components of the secondary network.

If, for example, a component of the primary network fails, the at least one monitoring device can control and in particular use the third communication device. The third communication device can be controlled by the at least one monitoring device in such a way that data can be transmitted directly between a still functional component of the primary network and a still functional component of the secondary network. This means that if, for example, the first sensor device fails, the second sensor device can take over the function of the first sensor device. The at least one monitoring device can then use the third communication device and in particular an interconnect between the first processing device and the second processing device, so that the environmental data recorded by the second sensor device can be transmitted to the first processing device via the second processing device.

A further embodiment provides that the at least one monitoring device is designed to control the third communication device upon detection of the malfunction of the at least one monitored component of the primary network in order to enable data transmission between the at least one component of the secondary network, which takes over the function of the at least one malfunctioning component of the primary network, and at least one functional component of the primary network.

In the event of a malfunction of one of the components of the primary network, this means that the at least one monitoring device can control or use the third communication device, in particular an interconnect of the third communication device, so that the component of the secondary network, which is designed to be redundant to the malfunctioning component of the primary network, is coupled to one of the functional components of the primary network for data transmission. If, for example, the first sensor device fails, the at least one monitoring device can control an interconnect between the second sensor device and the first processing device. The second sensor device can thus transmit the recorded environmental data directly to the first processing device.

A further embodiment provides that the at least one monitoring device is designed to control all components of the secondary network to take over the function of all components of the primary network when a malfunction of the at least one monitored component of the primary network is detected.

This means that if the at least one monitoring device detects a malfunction of one of the components of the primary network, the at least one monitoring device controls the components of the secondary network in such a way that the components of the secondary network take over the functions of the components of the primary network. The at least one monitoring device can thus enable a switchover from the primary network to the secondary network. If, for example, the first communication device fails, the second communication device does not take over the function of the first communication device in this case, but the entire primary network is switched off, so to speak, and the secondary network then takes over control of the autonomous motor vehicle.

A further embodiment provides that the components of the secondary network are designed to be diverse from the components of the primary network.

In other words, the motor vehicle network is not only redundant, but also redundantly diverse. This means that each of the components of the motor vehicle network can be present multiple times and can be designed in different ways.

In this case, the components of the primary network can comprise components from a different manufacturer than the components of the secondary network. Thus, for example, components of the first processing device can be provided by a first manufacturer and components of the second processing device by a second manufacturer. In addition or alternatively, different technologies can be used for the components of the primary network compared to the components of the secondary network. For example, the first sensor device can be implemented as a camera, while the second sensor device can be designed as a radar sensor. The same procedure can also be followed with the first and second communication devices. For example, both communication devices can be designed as an electrical data bus, wherein the first communication device can be implemented as a CAN bus, for example, while the second communication device can be implemented as a Flexray bus, for example. Alternatively, the first communication device can also be implemented as an electrical data bus, such as a CAN bus, whereas the second communication device can be implemented as an optical data bus, such as a MOST bus, or vice versa. In both cases, the respective data buses have different frequencies for data transmission.

This has the advantage that a malfunction of the entire motor vehicle network, in particular the primary network and the secondary network, for example due to systematic errors, is prevented.

A further embodiment provides that the primary network, the secondary network and the third communication device are arranged as at least one ring topology.

Particularly preferably, the components of the primary network, the secondary network and the third communication device are designed as a meshed ring topology. In this case, however, it must be ensured in every case that no component of the primary network and no component of the secondary network is simultaneously connected to a data bus that is essential for the primary network and a data bus that is essential for the secondary network and is intended for the error-free functionality of the respective network (such as CAN bus and/or Flexray). This prevents the malfunction of any component from simultaneously affecting both the primary network and the secondary network and forming a SPoF.

The invention also provides a method for operating a motor vehicle network, wherein the motor vehicle network has a primary network and a secondary network. The primary network comprises at least the following components: a first sensor device, a first processing device, a first actuator device and a first communication device which is designed to couple the first sensor device, the first processing device and the first actuator device to one another for data transmission. Accordingly, the secondary network comprises at least the following components: a second sensor device, a second processing device, a second actuator device and a second communication device which is designed to couple the second sensor device, the second processing device and the second actuator device to one another for data transmission. The components of the secondary network are designed to be redundant with regard to their function to the components of the primary network. The method comprises in a step a) checking whether at least one of the components of the primary network has a malfunction, and in a step b) in the event that the check is positive: controlling one of the components of the secondary network that is designed to be redundant with respect to the at least one function-controlled component of the primary network in such a way that the component of the secondary network takes over the function of the at least one function-controlled component of the primary network.

A positive check is defined as the determination that at least one of the components of the primary network is malfunctioning.

• 1 eine schematische Darstellung einer Topologie einer Ausführungsform eines Kraftfahrzeugnetzwerkes,
• 2 eine schematische Darstellung der Topologie einer Ausführungsform des Kraftfahrzeugnetzwerkes und eine mögliche Datenübertragung zwischen einzelnen Komponenten des Kraftfahrzeugnetzwerkes im Fall einer Funktionsstörung:
  1. a) einer ersten Sensoreinrichtung,
  2. b) einer ersten Verarbeitungseinrichtung,
  3. c) einer ersten Aktoreinrichtung, und
  4. d) einer ersten Kommunikationseinrichtung; und
• 3 eine schematische Darstellung eines Kraftfahrzeugs mit einem Kraftfahrzeugnetzwerk gemäß einer Ausführungsform der Erfindung.

The invention also includes the combinations of the features of the described embodiments. The embodiments and advantages described for the motor vehicle network according to the invention also apply analogously to the method according to the invention and vice versa. Exemplary embodiments of the invention are described below. Shown here:

• 1 a schematic representation of a topology of an embodiment of a motor vehicle network,
• 2 a schematic representation of the topology of an embodiment of the motor vehicle network and a possible data transmission between individual components of the motor vehicle network in the event of a malfunction:
  1. a) a first sensor device,
  2. (b) a first processing facility,
  3. c) a first actuator device, and
  4. (d) a first communication device; and
• 3 a schematic representation of a motor vehicle with a motor vehicle network according to an embodiment of the invention.

The exemplary embodiments explained below are preferred embodiments of the invention. In the exemplary embodiments, the components of the embodiments described each represent individual features of the invention that are to be considered independently of one another, which also develop the invention independently of one another and are therefore to be considered as part of the invention individually or in a combination other than that shown. Furthermore, the described embodiments can also be supplemented by other features of the invention already described.

In the figures, identical reference symbols designate functionally identical elements.

1 shows a motor vehicle network 100 with a primary network 102 and a secondary network 104. The motor vehicle network 100 also comprises a first energy supply 124 as a first energy supply device, a second energy supply 126 as a second energy supply device, a monitoring device 106 and a tertiary bus 128 as a third communication device. The primary network 102 comprises as components a first sensor device with a first sensor 108, a first processing device with a first controller 110, and a first actuator device with a first actuator 112. As a further component, the primary network 102 also comprises a first communication device, a primary bus 114, which connects the other components of the primary network 102 to one another for data transmission. That is, the first sensor 108 can transmit data to the first controller 110 via the primary bus 114 and vice versa, and the first controller 110 can transmit data to the first actuator 112 via the primary bus 114 and vice versa.

Analogous to the primary network 102, the secondary network 104 in the present example comprises a second sensor device with a second sensor 116, a second processing device with a second controller 118 and a second actuator device with a second actuator 120. Furthermore, the secondary network 104 comprises a secondary bus 122 as a second communication device as a further component. The secondary bus 122 connects the other components of the secondary network 104 for data transmission. This means that data can be transmitted from the second sensor 116 to the second controller 118 via the secondary bus 122, and vice versa, and data can also be transmitted from the second controller 118 to the second actuator 120 via the secondary bus 122, and vice versa.

The primary network 102 and the secondary network 104 are designed to be redundant to one another. This means that the components of the secondary network 104 are designed to be redundant in terms of their function to the components of the primary network 102, so that the secondary network 104 can be used as a replacement network for the primary network 102.

Analogous to this, 1 the first energy supply 124 and the second energy supply 126 are also designed to be redundant with respect to one another. The first energy supply 124 supplies the primary network 102, in particular the first sensor 108, the first controller 110 and the first actuator 112 with energy and the second energy supply 126 supplies the secondary network 104, in particular the second sensor 116, the second controller 118 and the second actuator 120 with energy.

In 1 An optional tertiary bus 128 is also shown, which in this embodiment connects a component of the primary network 102 and the redundant component of the secondary network 104 to each other for data transmission. For this purpose, the tertiary bus 128 has a first interconnect 130, a second interconnect 132 and a third interconnect 134. Interconnect refers to an intermediate connection device for data or signal transmission. The first interconnect 130 connects in the 1 the first sensor 108 with the second sensor 116. The second interconnect 132 connects the first controller 110 with the second controller 118. The third interconnect 134 connects the first actuator 112 with the second actuator 120.

The task of the monitoring device 106 is to 1 shown embodiment, to monitor the components of the primary network 102 and the components of the secondary network 104 for their functionality, which is described in the 1 is shown as dash-dotted arrows. In addition to the components of the primary network 102 and the components of the secondary network 104, the monitoring device 106 can also be designed to monitor the first energy supply 124 and the second energy supply 126 for their functionality. If the monitoring device 106 determines that, for example, one of the components of the primary network 102 is malfunctioning, the monitoring device 106 can control the component of the secondary network 104 that is redundant with the malfunctioning component of the primary network 102, so that the controlled component of the secondary network 104 takes over the function of the malfunctioning component of the primary network 102.

In the 1 the monitoring device 106 is designed as a global monitoring device for the entire motor vehicle network 100. Alternatively, the primary network 102 and the secondary network 104 could each have their own monitoring device, or each component of the primary network 102 or the secondary network 104 could even have its own monitoring device.

The design of the motor vehicle network 100 in 1 , i.e. in particular the networking of the components of the primary network 102 with the components of the secondary network 104 via the tertiary bus 128 preferably represents a so-called ring topology 136. In the first case, the nodes K of the ring topology are formed by the first and second sensors 108 and 116 as well as the first controller 110 and the second controller 118, whereas the connection edges V of the ring topology in this case are formed by the primary bus 114, the secondary bus 122 and the first and second interconnects 130, 132. In the second case, the edges of the ring topology are formed by the first controller 110, the second controller 118 as well as the first actuator 112 and the second actuator 120, whereas the connection edges V of the ring topology 136 are formed by the primary bus 114, the secondary bus 122, the second interconnect 132 and the third interconnect 134. In a configuration other than that in 1 In the embodiment shown, a meshed ring topology can also be provided by adding cross connections between the components of the primary network 102 and the components of the secondary network 104 via the tertiary bus 128.

A possible data transmission between the components of the primary network 102 and the components of the secondary network 104 in the event of a malfunction of one of the components of the primary network 102 is described in 2 shown. 2 shows again the motor vehicle network 100 with the primary network 102 and the secondary network 104. The primary network 102 comprises the first sensor 108, the first controller 110 and the first actuator 112. Accordingly, the secondary network 104 comprises the second sensor 116, the second controller 118 and the second actuator 120. In comparison to 1 are in 2 However, only those connections of the primary bus 114, the secondary bus 122 and the tertiary bus 128 are shown which could be used for data transmission by the monitoring device 106 in the event of the respective malfunction. In the 2 The malfunctioning components of the primary network are shown crossed out.

2a shows the data transmission between the individual components of the primary network 102 and the secondary network 104 in the event of a malfunction of the first sensor device. If the first sensor 108 of the first sensor device fails, the monitoring device 106, which is in 2 not shown, control the second sensor 116 to take over the function of the first sensor 108. Furthermore, the monitoring device 106 can also use the tertiary bus 128 and/or the primary bus 114 and/or the secondary bus 122.

In a first case, data transmission could then take place from the second sensor 116 via a fourth interconnect 138 to the first controller 110. Data transmission can then take place from the first controller 110 either via the primary bus 114 to the first actuator 112.

Alternatively, data transmission can also take place via a fifth interconnect 140 to the second actuator 120.

In a second case, data could be transmitted via the secondary bus 122 from the second sensor 116 to the second controller 118. Data could then be transmitted from the second controller 118 either via a sixth interconnect 144 to the first actuator 112, or via the secondary bus 122 to the second actuator 120.

2 B shows a possible data transmission between the individual components of the primary network 102 and the secondary network 104 in the event of a malfunction of the first controller 110. The monitoring device 106 could control the second controller 118 to take over the function of the first controller 110 and additionally use the secondary bus 122 and/or the tertiary bus 128.

According to the embodiment in 2 B In a first case, data could be transmitted from the first sensor 108 to the second controller 118 via a seventh interconnect 142. From the second controller 118, either the sixth interconnect 144 could then be used for data transmission between the second controller 118 and the first actuator 112. Alternatively, the secondary bus 122 could also be used for data transmission between the second controller 118 and the second actuator 120.

In a second case, the second sensor 116 could be controlled instead of the first sensor 108 and data could be transmitted via the secondary bus 122 between the second sensor 116 and the second controller 118. The second controller 118 would then have the same options for data transmission to the first actuator 112 or the second actuator 120 as described in case 1. 2c shows a possible data transfer between between the individual components of the primary network 102 and the secondary network 104 in the event of a malfunction of the first actuator device 112. In this case, the monitoring device could control the second actuator 120 to take over the function of the first actuator 112. Furthermore, the monitoring device could also use the primary bus 114 and/or the secondary bus 122 and/or the tertiary bus 128 for data transmission between the functional components of the primary network 102 and the secondary network 104.

In a first case, data could be transmitted from the first sensor 108 to the first controller 110 via the primary bus 114. From the second controller 110, data can then be transmitted between the first controller 110 and the second actuator 120 via the fifth interconnect 140.

In a second case, the monitoring device 106 could use the sixth interconnect 142 so that data can be transmitted between the first sensor 108 and the second controller 118. From there, data could then be transmitted between the second controller 118 and the second actuator 120 using the secondary bus 122.

In a third case, data could be transmitted from the second sensor 116 to the first controller 110 using the fourth interconnect 138. The fifth interconnect 140 could then be used again so that data can be transmitted between the first controller 110 and the second actuator 120.

In a fourth case, only the secondary bus 122 could be used, so that data can be transmitted between the second sensor 116 and the second controller 118, as well as the second controller 118 and the second actuator 120. In the fourth case, the components of the secondary network 104 would then each take over the functions of the components of the primary network 102, even if only one component of the primary network, namely the first actuator 112, has failed due to a malfunction.

2d shows a possible data transmission in the motor vehicle network 100 in the event of a malfunction of the first communication device, i.e. the primary bus 114. In this case, the monitoring device requests all components of the secondary network 104 to take over so that they take over the functions of the components of the primary network 102. This means that if the primary bus 114 fails, the secondary bus 122 is used so that data can be transmitted from the second sensor 116 to the second controller 118 and from the second controller 118 to the second actuator 120.

Analogously, components of the secondary network 104 or parts of the components may fail and be replaced by corresponding components of the primary network.

3 now shows a concrete design for an exemplary embodiment of the motor vehicle network 100. In 3 For this purpose, a motor vehicle 300 with the motor vehicle network 100, which includes the primary network 102 and the secondary network 104, is shown schematically. The motor vehicle 300 is designed in particular as an autonomously driving motor vehicle, i.e. a motor vehicle with a highly automated driving function (HAF function), in particular with an autonomy level greater than or equal to three.

In this embodiment, the first sensor device is designed as a camera 302, the first processing device is shown as a first microcontroller 304 of a first manufacturer and the first actuator device is designed as a primary brake 306. Furthermore, the first communication device in the embodiment is in 3 designed as CAN bus 314.

In contrast, the second sensor device is in 3 designed as a radar sensor 308, the second processing device is designed as a second microcontroller 310 from a second manufacturer and the second actuator device is designed as a secondary brake 312. Furthermore, the second communication device in this embodiment is designed as a Flexray bus 316.

As in 3 As shown, in this case the components of the primary network 102 are not only redundant but redundantly diverse compared to the components of the secondary network 104. This means that the components of the primary network 102 are functionally identical to the components of the secondary network 104, i.e. they fulfill the same function, but are different from one another in their design and in their function itself.

The example in 3 The following situation could be used as an example. The autonomous motor vehicle 300 is in normal driving mode, i.e. in particular in normal operation, and is supported by the primary network 102. The camera 302 is designed as a front camera and can capture images or image sequences in the front direction of travel of the autonomous motor vehicle 300. The captured images can be transmitted by the camera 302 via the CAN bus 314 to the first microcontroller 304. The first microcontroller 304 could evaluate the transmitted image data and, if necessary, generate a control command for the primary brake 306. The control command could then be transmitted from the first microcontroller 304 to the primary brake 306 via the CAN bus 314. The control command could be generated, for example, if the camera 302 detects that a vehicle driving ahead is braking in front of the autonomous motor vehicle 300.

Now, the autonomous motor vehicle 300 could, for example, drive past a transmission tower that transmits radio waves of a certain bandwidth. One of the frequencies in the bandwidth could, for example, interfere with the CAN bus 314, in particular with data transmission via the CAN bus 314. Accordingly, in this case the CAN bus 314 would either fail or the data transmission via the CAN bus 314 would be corrupted.

If, as in the example mentioned above, a vehicle driving ahead were to brake, the camera 302 would still be able to capture the situation correctly, but due to the corrupted data transmission via the CAN bus 314, the first microcontroller 304 would receive corrupted data, so that in the worst case, the first microcontroller 304 would not even control the primary brake 306 with a control command to brake.

If the motor vehicle network 100 now includes at least one monitoring device 106, the monitoring device 106 could detect an error in the data transmission via the CAN bus 314. The monitoring device 106 can preferably represent, for example, a component of the first microcontroller 304. An error in the data transmission between the camera 302 and the first microcontroller 304 can then be detected, for example, at the software level by a checksum calculation using the monitoring device 106 in the first microcontroller 304.

The monitoring device 106 could then prohibit the use of the entire primary network 102 and thus indirectly, so to speak, through the degradation of the entire primary network 102, request the secondary network 104 to take over the function of the primary network 102. Alternatively, the monitoring device 106 in the first microcontroller 304 could also transmit a control signal to the second microcontroller 310 of the secondary network 104. The second microcontroller 310 could then control the radar sensor 308 to capture radar data in the front direction of travel of the autonomous motor vehicle 300.

In this case, the redundant secondary network 104 could take over the function of the primary network 102. Since the Flexray bus 316 uses a different frequency for data transmission, its function would not be disrupted by the frequency of the radio transmitter. Accordingly, the monitoring device 106 could switch from the primary network 102 to the secondary network 104, so that the radar sensor 308 now detects the road in the direction of travel of the autonomous motor vehicle 300 and transmits the detected radar data to the second microcontroller 310 via the Flexray bus 316. The second microcontroller 310 can then analyze the radar data and generate a control command for the secondary brake 312, which is then transmitted again to the secondary brake 312 via the Flexray bus 316.

The redundant, diverse design of the motor vehicle network 100 could improve the driving safety of the autonomous motor vehicle 300 in road traffic, since the probability of failure of the motor vehicle network 100 would be reduced overall.

Overall, the invention shows a networking architecture for autonomous driving.

Claims (9)

Motor vehicle network (100) with a primary network (102), comprising at least the following components: a first sensor device (108, 302), a first processing device (110, 304), a first actuator device (112, 306), and a first communication device (114, 314), which is designed to couple the first sensor device (108, 302), the first processing device (110, 304), and the first actuator device (112, 306) to one another for data transmission, characterized in that the motor vehicle network (100) further comprises: - a secondary network (104), which has as components at least: a second sensor device (116, 308), a second processing device (118, 310), a second actuator device (120, 312), and a second communication device (122, 316), which is designed to couple the second sensor device (116, 308), the second Processing device (118, 310) and the second actuator device (120, 312) for data transmission, wherein the components of the secondary network (104) are designed to be redundant with respect to their function to the components of the primary network (102), - a first energy supply device (124) which is designed to supply only the primary network (102) with energy, and - a second energy supply device (126) which is separate from the first energy supply device (124) and is designed to supply only the secondary network (104) with energy, wherein the second energy supply device (126) is designed to be redundant to the first energy supply device (124), and - at least one monitoring device (106) which is designed to monitor at least one of the components of the primary network (102), wherein in the event that the monitoring device (106) detects a malfunction of the at least one monitored component of the primary network (102), the at least one component of the secondary network (104) designed to be redundant for this purpose is designed to take over the function of the at least one malfunctioning component of the primary network (102), wherein - the monitoring device (106) is further designed to monitor the first energy supply device (124) as well and in the event that the monitoring device (106) detects a malfunction of the first energy supply device (124), all components of the Secondary network (104) to take over the function of all components of the primary network (102). Motor vehicle network (100) to Claim 1 , characterized in that the at least one monitoring device (106) is designed, upon detection of the malfunction of the at least one monitored component of the primary network (102), to control the at least one redundant component of the secondary network (104) to take over the function of the malfunctioning component of the primary network (102). Motor vehicle network (100) to Claim 2 , characterized in that the motor vehicle network (100) comprises a third communication device (128) which is designed to couple at least one of the components of the primary network (102) directly to at least one of the components of the secondary network (104) for data transmission. Motor vehicle network (100) to Claim 3 , characterized in that the at least one monitoring device (106) is designed to control the third communication device (128) upon detection of the malfunction of the at least one monitored component of the primary network (102) in order to enable direct data transmission between at least one of the functional components of the primary network (102) and at least one of the functional components of the secondary network (104). Motor vehicle network (100) to Claim 3 or 4 , characterized in that the at least one monitoring device (106) is designed, upon detection of the malfunction of the at least one monitored component of the primary network (102), to control the third communication device (128) in order to enable data transmission between the at least one component of the secondary network (104), which takes over the function of the at least one malfunctioning component of the primary network (102), and at least one functional component of the primary network (102). Motor vehicle network (100) to Claim 2 , characterized in that the at least one monitoring device (106) is designed, upon detection of the malfunction of the at least one monitored component of the primary network (102), to control all components of the secondary network (104) to take over the function of all components of the primary network (102). Motor vehicle network (100) according to one of the preceding claims, characterized in that the components of the secondary network (104) are designed to be diverse from the components of the primary network (102) with regard to their design. Motor vehicle network (100) according to one of the Claims 3 until 7 , characterized in that the primary network (102), the secondary network (104) and the third communication device (128) are arranged as at least one ring topology (136). Method for operating a motor vehicle network (100) with - a primary network (102) comprising at least the following components: a first sensor device (108, 302), a first processing device (110, 304), a first actuator device (112, 306), and a first communication device (114, 314) which is designed to couple the first sensor device (108, 302), the first processing device (110, 304), and the first actuator device (112, 306) to one another for data transmission, - a secondary network (104) comprising at least the following components: a second sensor device (116, 308), a second processing device (118, 310), a second actuator device (120, 312), and a second communication device (122, 316) which is designed to couple the second sensor device (116, 308), the second processing device (118, 310), and the second actuator device (120, 312) for data transmission, wherein the components of the secondary network (104) are designed to be redundant with respect to their function to the components of the primary network (102), and -a first energy supply device (124), which is designed to supply only the primary network (102) with energy, and -a second energy supply device (126) which is separate from the first energy supply device (124) and which is designed to supply only the secondary network (104) with energy, wherein the second energy supply device (126) is designed redundantly to the first energy supply device (124), comprising the following steps: a) checking whether at least one of the components of the primary network (102) has a malfunction, wherein b) in the event that the check is positive: controlling one of the components of the secondary network (104) which is designed redundantly to the at least one malfunctioning component of the primary network (102) such that the component of the secondary network (104) takes over the function of the at least one malfunctioning component of the primary network (102), and c) checking whether the first energy supply device (124) has a malfunction, wherein d) in the event that the check is positive: controlling all components of the secondary network (104) to take over the function of all components of the primary network (102).

Images